nixos/profiles/networking.nix

   1 { config, pkgs, lib, hostName, ... }:
   2 let
   3   wg-intra-peers = import wireguard/wg-intra/peers.nix;
   4 in
   5 {
   6 imports = [
   7   networking/nftables.nix
   8 ];
   9 networking = {
  10   hostName = hostName;
  11   domain = lib.mkDefault "localdomain";
  12   #search = [ "sourcephile.fr" ];
  13   firewall = {
  14     enable = lib.mkDefault true;
  15     allowPing = lib.mkDefault true;
  16   };
  17   networkmanager = {
  18     enable = lib.mkDefault config.services.xserver.enable;
  19     #dhcp = "dhcpcd";
  20     logLevel = lib.mkDefault "INFO";
  21     wifi = {
  22       #backend = "iwd";
  23       #backend = "wpa_supplicant";
  24       powersave = lib.mkDefault false;
  25     };
  26   };
  27   usePredictableInterfaceNames = true;
  28 };
  29
  30 programs.mtr.enable = true;
  31 programs.usbtop.enable = true;
  32
  33 services.avahi = {
  34   enable = lib.mkDefault true;
  35   nssmdns = lib.mkDefault true;
  36   openFirewall = lib.mkDefault false;
  37   publish.enable = lib.mkDefault false;
  38 };
  39 networking.nftables.ruleset = lib.mkIf config.services.avahi.enable (''
  40   table inet filter {
  41     chain output-lan {
  42       skuid root udp sport 5353 udp dport 5353 comment "Avahi"
  43     }
  44   }
  45 '' + lib.optionalString config.services.avahi.openFirewall ''
  46   table inet filter {
  47     chain input-lan {
  48       udp dport 5353 comment "Avahi"
  49     }
  50   }
  51 '');
  52
  53 services.openssh = {
  54   enable = lib.mkDefault true;
  55   forwardX11 = lib.mkDefault true;
  56   openFirewall = lib.mkDefault false;
  57   listenAddresses = [
  58     { addr = wg-intra-peers.${hostName}.ipv4; port = 22; }
  59   ];
  60 };
  61 networking.firewall.extraCommands = lib.mkIf config.services.openssh.enable ''
  62   ip46tables -A nixos-fw -i wg-intra -p tcp -m tcp --dport 22 -j ACCEPT
  63 '';
  64 systemd.services.sshd.after = ["wireguard-wg-intra.service"];
  65 }